Lunary Improper Access Control Vulnerability Allowing Unauthorized Access to User Prompt Data

An improper access control vulnerability has been identified in Lunary AI's application, specifically in versions prior to 1.6.3. The issue allows users to access prompt data belonging to other users. This vulnerability, present in version 1.6.2 and the main branch, enables unauthorized individuals to view sensitive prompt information by navigating to specific URLs, potentially leading to the exposure of critical data.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive user prompt data, allowing for the potential misuse or exposure of critical information.

Remediation

Users can update to Lunary version 1.6.3 or later to address this vulnerability.